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A method and apparatus is disclosed for synchronizing files stored in memory of two 
remotely located systems. The system can generate a copy of a source file at the 
destination location without transferring all the data of the source file. The 
destination location includes a reference file that can contain similar data as that 
contained in the source file. The synchronization is accomplished by sending keys 
(representing reference blocks of data from the reference file) to the source system. 
At the source system, a portion of each keys called a Feature is compared with 
portions of source file. If the Features match, a checksum corresponding to the 
reference block is compared with a check sum corresponding to the source block. If the 
checksums match, an short message identifying the key and reference block that matched 
is transmitted to the destination system in order that the reference block can be 
copied from the reference file in order to build the synchronized file. 
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ABSTRACT : 

A method of monitoring logical connections in a computer network is described. All 
packets exchanged via the network are intercepted and analyzed. Upon receipt of a 
packet, a connection management engine determines whether packet is part of an 
existing logical connection. If it is not, a new record is created and stored in a 
connection record database. Otherwise, the existing record for the logical connection 
in the connection record database is updated. 

Also described is a method of monitoring file transfers in a computer network. File 
transfers are monitored using an file transfer record database, which allows each 
packet of the file transfer to be placed in proper context. Upon interception of a 
packet, an application management engine (AME) first determines whether the packet is 
part of a file transfer . If it is not, the AME ignores the packet. On the other hand, 
if the packet is part of a file transfer, then the AME determines whether if the 
packet is part of a new file transfer or a one of a multiplicity of existing file 
transfers. The AME creates a new record if the packet is the start of a new file 
transfer. If the packet is part of an existing file transfer, then the AME searches 
the file transfer record database to locate the record for the file transfer, which 
the packet is part of. Once located, the record is updated. 

Apparatus for monitoring file transfers and logical connections are also described. 
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